Malicious code in dolyame-boxy-independent-bnpl-main-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fd169fe81bc68427ce8c3b472cb376e6d3fdad489d07595a8c8f08f894ac154 On require, index.js loads polyfill.js which reconstructs hostnames from split string fragments e.g., 'oob-worker.cf99-9b3.wor'+'ke'+'rs.dev' to reac...

MAL-2026-13176 Malicious code in dolyame-ui-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf459576a54fb40358c8e22e4283559ce302a6d6e2c6cd545b48ae9be4d8ccf index.js unconditionally requires./bridge on load. bridge.js assembles Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and a DNS-TXT...

Malicious code in devplatform-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from...

GHSA-6VHH-4XW6-H2H2 Element Call reports full URLs of visited pages to analytics server

Impact Element Call versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a posthog key in config.json or by the posthogApiHost and posthogApiKey URL parameters. Several fields of this data $initialpersoninfo, $sessionentryurl, and $currenturl were found ...

EUVD-2023-29622

Malicious code in bioql PyPI...

CVE-2023-25712

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP-Buddy Google Analytics Opt-Out plugin = 2.3.4 versions...

CVE-2023-25712

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP-Buddy Google Analytics Opt-Out plugin = 2.3.4 versions...

CVE-2023-25712: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP-Buddy Google Analytics Opt-Out plugin = 2.3.4 versions...

PT-2023-20266

Name of the Vulnerable Software and Affected Versions WP-Buddy Google Analytics Opt-Out plugin versions prior to 2.3.5 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication with admin+ privileges. Recommendations For WP-Bud...